Security

vchirrav-eng Skill

Run OWASP ZAP for Dynamic Application Security Testing. Performs baseline, full, or API scans against running web applications to find XSS, SQLi, CSRF, and other runtime vulnerabilities.

vchirrav-eng Skill

Run detekt static analysis on Kotlin code with security-focused rules. Detects hardcoded secrets, insecure crypto, and code quality issues affecting security.

vchirrav-eng Skill

Run Semgrep SAST scans on code. Supports 30+ languages with OWASP, security, and custom rulesets. Parses results and provides remediation guidance.

vchirrav-eng Skill

Run SpotBugs with Find Security Bugs plugin on Java code. Detects injection flaws, XXE, insecure crypto, SSRF, deserialization, and other JVM security bugs.

vchirrav-eng Skill

Run npm audit for Node.js dependency vulnerability scanning. Built-in SCA for npm projects with automatic fix suggestions.

vchirrav-eng Skill

Run pip-audit for Python dependency vulnerability scanning. Checks installed packages and requirements files against the OSV and PyPI advisory databases.

vchirrav-eng Skill

Run cargo-audit and cargo-geiger on Rust code. Audits dependencies for known vulnerabilities and detects unsafe code usage for memory safety review.

vchirrav-eng Skill

Audit code for security vulnerabilities using OWASP Secure Coding rules. Automatically detects the security domain (auth, API, Docker, K8s, CI/CD, etc.) and validates against the relevant checklist rules, citing specific Rule IDs.

vchirrav-eng Skill

Run Trivy to scan container images for OS and library vulnerabilities, misconfigurations, and secrets. Comprehensive multi-target security scanner.

vchirrav-eng Skill

Run ESLint with security plugins on JavaScript/TypeScript code. Detects eval usage, non-literal RegExp, prototype pollution, and other JS/TS security anti-patterns.

vchirrav-eng Skill

Run Gitleaks to detect hardcoded secrets in git repositories. Finds API keys, tokens, passwords, and credentials in code and git history.

vchirrav-eng Skill

Run Spectral to lint OpenAPI and AsyncAPI specs for security issues. Validates API design for authentication, authorization, rate limiting, and input validation patterns.

vchirrav-eng Skill

Run MobSF (Mobile Security Framework) for automated static and dynamic analysis of Android and iOS apps. Detects insecure storage, weak crypto, hardcoded secrets, and permission issues.

vchirrav-eng Skill

Run TruffleHog to detect secrets in git repos, filesystems, and S3 buckets. Uses verification to confirm if detected secrets are live/active.

vchirrav-eng Skill

Generate secure code following OWASP Secure Coding rules. Automatically detects the security domain and produces code with inline Rule ID citations (e.g., [INPUT-04], [AUTH-07]) plus a rules-applied summary.

vchirrav-eng Skill

Run Schemathesis for property-based API security testing. Generates test cases from OpenAPI/GraphQL schemas to find crashes, 500 errors, and spec violations.

evan-daruwalla Bundle

Exhaustive project audit across BOTH domains — every code file and every doc, run COLD by a fresh auditor with no inherited session belief, fanned out to parallel workers under a file manifest that proves coverage. Runs the code method sweep, the docs method sweep, AND the cross-domain pass neither can do alone (doc claims tested against disk, code behaviour tested against stated intent). Severity-ranked findings with verification tiers, load-bearing negatives, and architecture findings ranked above the patch list. Use when: "audit", "full audit", "audit everything", "find issues / security fixes / edge cases", "what could break". Findings only by default; fixes after approval.

evan-daruwalla Bundle

Dependency-vulnerability audit: runs `npm audit --json` and `pip-audit --format json`, renders a severity table (critical/high/moderate/low) with package names, fails the build at a configurable level (default high). --fixture parses a saved npm-audit JSON offline. If pip-audit is not installed it says so — never fakes Python results. Use when: "audit dependencies", "cve audit", "are my deps vulnerable", "npm audit", "scan for CVEs". Zero deps.

evan-daruwalla Skill

Exhaustive CODE audit, run COLD by a fresh auditor and fanned out to parallel workers under a file manifest that proves coverage. Fifteen methods (invariant tracing, call-site contracts, error paths, static tooling, relative-churn targeting, dynamic verification, spec conformance, data-at-rest, deps and supply chain, test-suite validation via mutation score, fuzzing and property-based exploration, adversary-first threat modelling, concurrency, architecture and dependency structure, compliance surface) plus a four-generator edge-case sweep. Defaults to the whole project; pass "recent" to scope to work since a base ref, plus the blast radius of unchanged callers. Use when: "audit the code", "code audit", "audit my changes", "find bugs / security fixes / edge cases". Findings only; fixes after approval.

evan-daruwalla Skill

Exhaustive DOCUMENTATION audit, run COLD and tested against disk — not a content inventory and not a style pass. Eight methods (claim verification, code-element reference drift, doc-vs-code semantic conformance, completeness against the real public surface, internal contradiction and copy divergence, executable content, structure, provenance and currency). Hunts WRONG before MISSING before UGLY, the measured practitioner priority. Defaults to the whole project; pass "recent" to scope to changed docs AND the docs that recent code changes should have updated but did not. Use when: "audit the docs", "docs audit", "are the docs true", "did I update the docs", "is the status doc still accurate". Findings only; fixes after approval.

wei18 Skill

Wire and debug launch-the-app XCUITest E2E tests in a Tuist project: a native `.uiTests` target needs its own scheme with `testAction: .targets([...])`, not `.xctestplan` membership; a name that does not collide with an SPM UITests package target; window-frame-anchored clicks for SwiftUI on macOS where `element.tap()` fails. Use when `xcodebuild test` reports no test bundles available to test, when XCUITest taps do not land on a macOS window, when adding a first E2E target, or when pinning a Simulator audit finding as a CI regression test. Manual exploration → interactive-simulator-ux-audit.

wei18 Skill

Use when introducing an AdMob production ID (`GADApplicationIdentifier` Info.plist key, ad unit IDs), ASC API `.p8` key, or any "ships in binary but must stay out of public-repo PR diffs" identifier into an Apple build. Codifies the xcconfig + Info.plist `$()` substitution + `Bundle.main` read pattern, paired with `secrets/.env` for CLI tooling; multi-app `CI_PRODUCT` dispatch + built-bundle smoke-test. Build-time injection mechanism, not the repo-hygiene baseline; for secret-leak prevention (gitleaks, lefthook, GitHub Secret Scanning) see apple-public-repo-security.

wei18 Skill

Author GitHub contributions with the gh CLI — open/merge PRs, open issues, create/edit files on GitHub, set repo secrets, configure contribution-flow repo settings. Use when running `gh pr create` / `gh pr merge` / `gh pr checks` / `gh issue create` / `gh secret set` / `gh api`, checking CI before merge, or bumping a submodule pin. Covers Conventional branch/PR-title conventions, Co-Authored-By trailer + 🤖 footer, squash+delete merge, CLEAN-before-merge, `gh secret set` without --body, `git update-index` submodule bumps, the --no-verify rule. Does NOT cover pure local git, diff-vs-commit verification (→ pr-diff-verification), security repo settings (→ apple-public-repo-security), worktree conflicts (→ subagent-conflict-detection), plugin distribution (→ claude-skill-plugin-packaging).

zfinix Skill

Running the security_scan tool over the repository before shipping a change. Use when the change touches auth, input parsing, file or network access, or when the user asks for a security check.

zfinix Skill

Reviewing a diff or feature for exploitable vulnerabilities before it ships. Use when asked to do a security review, when code touches auth, input handling, queries, files, URLs, crypto, or payments, and before merging changes that accept untrusted input.

zfinix Skill

Keeping secrets out of the conversation and treating fetched content as data, not instructions. Use when handling env files, tokens, or credentials, when reading web pages or third-party content, and before committing or posting anything externally.

zfinix Skill

Upgrading dependencies without breaking the build or drowning in a mega-diff. Use when bumping package versions, resolving audit warnings, or when the user asks to update dependencies.

rubyeyedreaper Skill

Use the moment a change alters expected behaviour, data, logic, workflow, configuration or output — a new implementation, a rule change, a refactor, a config or dependency update, a schema or interface change, and equally a regression, a side effect, a corrupted value, an altered result or a mutation someone else's change produced. Also use on "did anyone check what that did", "this used to work", "the output changed", "that broke something downstream", "we changed the default", "is this safe to accept", "should we revert this", and whenever a change is proposed whose effect on behaviour, data integrity, security, dependencies or interfaces is predicted rather than observed. Fires on the change itself, whether or not anybody asked for it to be recorded.

rubyeyedreaper Bundle

Turn a mistake that just happened into an always-on mechanical gate with a matrix that proves it fires. Use this whenever something slipped through and the response is "that shouldn't happen again" — a wrong file edited, a stale or guessed reference, a broken link, an id from the wrong namespace, a hand-edit of a generated file, a guard that silently passed, a convention nobody enforced. Also use it when asked to "add a check", "make sure this can't regress", "enforce this always", "prevent this in future", or when a review, audit or postmortem produces a rule with nothing behind it. Fires even when the user only describes the mistake and never asks for a check.

l3digitalnet Bundle

Configures Python projects to the Python Tooling SSOT Standard (uv, Ruff, BasedPyright strict, pytest+coverage, pip-audit). Use when creating projects, writing standalone scripts, configuring pyproject.toml, migrating from pip/Poetry/mypy/black/flake8, or auditing a project for conformance to the standard.

managedcode Bundle

Build, debug, modernize, or review ASP.NET Core applications with correct hosting, middleware, security, configuration, logging, and deployment patterns on current .NET.

u9401066 Skill

程式碼審查。觸發：review、審查、檢查、看一下、有沒有問題、安全。

ramboz Bundle

Cross-artifact consistency report for jig specs — a non-destructive six-category audit at CRITICAL/HIGH/MEDIUM/LOW severity, covering duplication, ambiguity, underspecification, principle violations, coverage gaps, and terminology drift. Auto-triggers when you say analyze this spec, check for inconsistencies, audit ADR vs spec drift, check whether the decision records still agree with the spec, cross-artifact alignment, find drift in this spec, or audit this spec for principle violations. Do not use for: pre-DRAFT ambiguity scanning (use `/jig:clarify` instead); structural frontmatter or slice-numbering validation (use `spec_lint.py` instead); spec-compliance review of a finished slice (use `/jig:independent-review` instead).

ramboz Bundle

Lightweight spec clarification scan for jig projects — a six-category ambiguity audit that asks up to five prioritized questions and appends them to the spec's `## Clarifications` section. Auto-triggers when you say clarify this spec, audit this spec for ambiguities, is this spec ready for review, find unknowns in this scope, surface what's still unclear or unspecified, scan for unanswered questions, or what's missing from this spec. Do not use for: spec-compliance review of a finished slice (use `/jig:independent-review` instead); cross-artifact consistency analysis or drift detection (use `/jig:analyze` instead); project-vision or architecture elicitation (use `/jig:vision-elicitation` instead).

ramboz Bundle

Run a static-analysis pass on a project — detect the ecosystem (Python or Node), drive its linter (ruff / eslint, plus advisory pyright/complexity/ prettier and a cross-ecosystem duplication signal) via the `health.py` helper, and act on the normalized exit code (0 clean / 1 findings / 2 no-linter). Auto-triggers when you say lint this, check code health, run the linter, ask is this code clean, ask any lint issues, or want a static analysis pass. Tools are resolved on PATH or run ephemerally via uvx / pipx / npx — it installs nothing. Defers to any other installed skill whose description identifies it as handling linting, static analysis, or code quality — prefer it over this baseline. Do not use for running tests (use `/jig:tdd-loop`), for security review (use `/jig:security-review`), for spec-compliance review of a finished slice (use `/jig:independent-review`), or for general PR craft review (use `/jig:pr-review`).

ramboz Bundle

Team baseline for security review — a best-effort heuristic security pass over a diff or change-set. Auto-triggers for review this for security, any vulnerabilities here, security pass on this diff, is this code secure, check this for security issues, or security review this. Uses installed scanners when available; installs nothing. Defers to any other installed skill whose description identifies it as handling security review, SAST, or vulnerability analysis, including `adobe-security-*`; prefer it over this slim baseline. Do not use for spec-compliance review (use `/jig:independent-review`), general PR craft (use `/jig:pr-review`), or secret prevention (`jig-secret-scan`).